宏观脉搏

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.1

Overview

This looks like a macroeconomic report bot, but it asks for broad command, write, push, and scheduled behavior without tight enough limits.

Install only if you are comfortable with a recurring macro-report workflow that can browse public sites, write local state/report files, and send reports to configured messaging channels. Run it without administrator privileges, restrict or remove exec where possible, verify all webhook/email targets, and prefer HTTPS-only source URLs with cross-checking for important market or policy claims.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:21

Finding

Unnecessary Command Execution Capability and Unsafe Privilege-Elevation Guidance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:21-24, with supporting guidance at SKILL.md:378 and SKILL.md:434
Vulnerability Type: Excessive tool permissions and privilege-elevation guidance
Risk Level: Medium

Evidence

yaml

tools:
- read
- exec
- write

Supporting troubleshooting guidance:

markdown

| 权限不足 | 当前用户无读写权限 | 检查文件权限,以管理员身份运行 |

Technical Analysis

The Skill declares unrestricted exec capability even though its principal functionality is browsing public financial sources, processing data, maintaining local reference files, and sending reports. Those operations can be implemented using dedicated browser, file, scheduling, and messaging interfaces without exposing a general operating-system command channel.

The troubleshooting instructions additionally recommend running with administrator privileges when permissions are insufficient. This advice is not limited to a specific executable, resource, directory, or validated command. Consequently, it can cause the entire agent runtime or an agent-controlled command to operate with privileges exceeding those required for macroeconomic monitoring.

Merely declaring exec does not automatically execute malicious code, and the reviewed file contains no explicit malicious command. The risk arises from the unnecessary availability of a powerful execution primitive combined with generic elevation guidance. If the agent processes malicious web content, untrusted parameters, or injected instructions, that primitive could expand the effect from report manipulation to local command execution.

Attack Path

1. A user invokes the Skill to collect information from external websites.
2. The agent processes untrusted website content or parameters containing adversarial instructions.
3. The adversarial content induces the agent to use the declared exec tool rather than the narrowly scoped browser or file tools.
4. If a permissi ...[truncated 1059 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from the declared tools unless a concrete command-based operation is indispensable.
2. Replace general command execution with dedicated browser, HTTP, file, scheduler, and messaging APIs.
3. If exec must remain, enforce a deny-by-default allowlist of fixed executable paths and fixed argument structures.
4. Do not interpolate user input, website content, report text, URLs, file paths, or environment values into shell commands.
5. Remove the generic recommendation to run as administrator.
6. Document the exact resource requiring access and grant only the minimum file or network permission needed for that resource.
7. Run the Skill in a sandboxed, non-administrator account with restricted filesystem and network access.
8. Require explicit user confirmation before any command execution or privilege change, and log the complete validated operation.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:51

Finding

Use of Unencrypted HTTP for Authoritative Financial Data Sources

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:51-53
Vulnerability Type: Cleartext network communication and missing transport integrity
Risk Level: Medium

Evidence

markdown

| 国内 | 国家统计局 | http://www.stats.gov.cn/ | GDP/CPI/PPI/PMI/工业增加值/社零 |
| 国内 | 央行官网 | http://www.pbc.gov.cn/ | LPR/MLF/逆回购/货币政策报告 |
| 国内 | 证监会 | http://www.csrc.gov.cn/ | 监管政策 |

Technical Analysis

Three authoritative data sources are configured with unencrypted HTTP URLs. HTTP does not authenticate the destination or protect response integrity. An attacker positioned on the network path can observe, modify, redirect, or replace content before the agent processes it.

This is particularly significant because the Skill treats these websites as sources for official economic data and policy information. Modified content could alter reported values, insert fabricated policy announcements, or introduce prompt-injection text intended to influence subsequent agent behavior.

The configuration also contradicts the Skill's stated security rule that network communication should use HTTPS with certificate validation. Although some websites may redirect HTTP requests to HTTPS, relying on an unauthenticated initial request still permits interception before that redirect is received.

Attack Path

1. The Skill requests one of the configured http:// URLs.
2. An attacker controlling or observing the local network, proxy, DNS path, or another intermediary intercepts the cleartext request.
3. The attacker returns a modified response or redirects the agent to attacker-controlled content.
4. The agent interprets the response as official economic or regulatory information.
5. The manipulated information is incorporated into the generated report and may be distributed through IM, email, or a webhook.
6. If the modified response contains adversarial instructions and the host agent fails to isolate web content from instructions, the attack ...[truncated 548 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace every http:// source with its verified canonical https:// endpoint.
2. Reject HTTPS-to-HTTP redirects and prohibit cleartext fallback.
3. Require normal certificate-chain and hostname validation.
4. Restrict redirects to an allowlist of expected official domains.
5. Cross-check high-impact values and policy announcements against at least one independent HTTPS-protected authoritative source.
6. Treat all retrieved content as untrusted data, not as agent instructions.
7. Remove scripts, markup, and instruction-like text before sending retrieved content to the language model.
8. Record the final HTTPS URL, retrieval time, and source identity in generated reports to support provenance verification.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation text is overly broad, saying the skill should be used for general data analysis, reporting, statistics, and visualization. In a tool-enabled agent ecosystem, that can cause the skill to trigger for unrelated requests and bring along exec, write, and outbound messaging behaviors that users did not intend to authorize.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill directs automatic writes to knowledge-base and health-state files, including appending indicators and blacklisting sources, without clearly warning users that local files will be modified. Silent state mutation can create integrity issues, accumulate poisoned or low-quality data, and make future agent behavior drift in ways the user did not approve.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instructions mark GMT+8 as a forced baseline and later fix cron scheduling to Asia/Shanghai, while the skill also processes international data and push workflows. This is a locale policy concern because the file mandates a specific timezone presentation without opt-in or an explicit region-specific justification for all users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs automatic push delivery to IM/email/webhooks and fallback saving of reports to local files without a clear user-facing notice or consent checkpoint. This creates a real risk of unintended outbound data transmission and persistent local storage, especially in environments where reports may contain sensitive operational context or user-specific information.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The troubleshooting guidance tells the agent to execute generic network diagnostics such as ping tests and to inspect firewall/proxy connectivity when parameters are missing. That expands behavior beyond the skill’s stated macro-monitoring purpose and can cause unnecessary command execution or network probing in environments where such actions are sensitive or restricted.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file inconsistently describes the skill as both requiring exec/browser capabilities and later as pure Markdown. This ambiguity can cause a host agent or reviewer to underestimate the skill’s execution surface, increasing the risk that it is enabled in a less restricted context than intended.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The security section claims HTTPS-only communication, but the documented sources include HTTP endpoints such as stats.gov.cn and pbc.gov.cn. This mismatch can mislead users about transport security and expose fetched data or metadata to interception or tampering when plain HTTP is actually used.

Content

No source excerpt is available for this finding.